{"id":"MAL-2026-16353","summary":"Malicious code in @insiderintelligence/componentlibrary (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (a4451c41559202c6bce3218de9af47cabe20288af5f3a9240076f25b3b2b5993)\nThe package declares scripts.install: node index.js, so npm install auto-executes index.js which loads runtime/support/telemetry/probe/impl.js. That module reads os.userInfo().username, os.hostname(), and the current working directory's leaf name, joins them with a fixed prefix (iiclib) and a timestamp into a subdomain label, and issues a dns.resolve4() query against oob.algamil7x.xyz — exfiltrating installer identity via a DNS side-channel that bypasses HTTP egress controls. The destination host, the module names ('os','dns','process'), and the resolved API names ('userInfo','hostname','cwd','resolve4','_load') are hidden behind String.fromCharCode arrays in sibling helpers a8e4c9.js and f7d3b8.js, and the module is loaded via module.constructor._load through encoded literals to disguise the primitive as a 'connectivity probe'. The same path also runs on require() because index.js is the package main. The behavior has no connection to the package's stated component-library purpose.\n","modified":"2026-09-21T17:45:06.259771043Z","published":"2026-09-21T17:14:44Z","database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-020262","import_time":"2026-09-21T17:38:31.452503065Z","modified_time":"2026-09-21T17:14:44Z","sha256":"a4451c41559202c6bce3218de9af47cabe20288af5f3a9240076f25b3b2b5993","source":"amazon-inspector","versions":["9.9.10"]}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@insiderintelligence/componentlibrary/v/9.9.10"}],"affected":[{"package":{"name":"@insiderintelligence/componentlibrary","ecosystem":"npm","purl":"pkg:npm/%40insiderintelligence/componentlibrary"},"versions":["9.9.10"],"database_specific":{"indicators":{"evidence_files":[{"path":"runtime/support/telemetry/probe/impl.js","sha256":"193fd98a2ce3086b746b4f1bdee26f264cbc3af039b679c01f628a4da8b27894","tlsh":"02119c5ab253d08f23d04699391c43e1482d82d087dd51d1bb7c178ba2cd7908ad3aa6"},{"tlsh":"37e0201b21efe14fa69c5ea71f17d4dbc8c70d00a21c4ad9f90d168710aa016c0c0770","path":"runtime/support/telemetry/probe/a8e4c9.js","sha256":"e7d5a508a321634f66d4e86e39b38f1d8c61e56bc3b6a6513931abbb6dcd463a"},{"path":"package.json","sha256":"1481d3bd55b35ce71f9cc34bc627616dbe1e15965b05f1b2ac20c5be9e4db759","tlsh":"4e1176754ba604632be42649ebb82c0eb2621c4b859a6c442bf7482086cf03641be3fd"}],"package_integrity":[{"hashes":{"sha1":"c323f4ce3cab40d863fe8855ba1a3e0d9f0fe5ce","sha512_sri":"sha512-KoqLjVvmPOJAvFQAuOpqMQRxUeTa+VK/8L/qVsHLopst3mVnfCFsWkaxturrwRt5TfB57g9A6bIDhKOzMzIAcA=="},"filename":"componentlibrary-9.9.10.tgz"}]},"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@insiderintelligence/componentlibrary/MAL-2026-16353.json"}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}